AIKIDO-2026-209386

TL;DR

The emoji node stores raw pasted innerHTML unsanitized at the parseDOM entry point and later assigns it to innerHTML on a live element during toMarkdown serialization, so an <img onerror=...>-style payload executes on the next serialization cycle even though the element is never attached to the document. Untrusted emoji markup thereby reaches a live DOM sink without sanitization. The fix sanitizes the value with DOMPurify at the untrusted parseDOM entry so it never enters document state, and parses via an inert <template> (with a sanitize call for defense in depth) during serialization.